Unified Extensible Firmware Interface (UEFI) is a specification created by a non-profit industry body detailing a programming interface between the Operating System and the included firmware of a computing device such as (but not limited to) a Personal Computer (PC). UEFI specifications describe a set of tools by which a computing device can move in an organized fashion from the power-applied state to fully operational. The computing device is initialized by firmware included within the device and this firmware provides a range of software services which facilitate the boot of the operating system as well as providing a smaller subset of these services that continue to be available after operating system has booted. The UEFI specification tells the desired result but deliberately does not specify the internal tactic of implementation. The UEFI firmware specification replaces earlier OS/firmware interfaces previously used by the industry and commonly known as legacy BIOS.
The UEFI specification provides a facility called driver signature checking by which software from other parties can be ‘signed’ using public/private key cryptographic techniques at its origin. This signature is validated by the computing device firmware prior to allowing this software to operate. The signature checking concentrates on software added to configure optional components (plug-in boards) and software supplied by the operating system for early boot steps (OS boot loaders). The signature checking is accomplished with a library of approved keys. The computing device must take care to not allow unauthorized software elements any ability to modify the library of approved keys as this would allow rogue software elements to defeat the signature checking.
When implemented in a computing device, the machine codes for UEFI firmware and all permanent data used by the firmware reside in Read Only Memory (ROM). In many cases the ROM is an Electrically Erasable silicon device known as a flash ROM. Flash ROM has the characteristic that it can be erased by electrical command and individual elements may then be written and the device will retain the data indefinitely. When power is first applied to the computing device, the system executes a process called reset which clears the state to a known condition and begins execution of the firmware. The firmware is read from the flash ROM. Among other services, the firmware is responsible for operation of the computing device until a boot process can be run which loads an operating system for the computing device into memory. Once loaded, the operating system is in charge of normal operation of the computing device. Of note, anti-virus programs for the computing device require the operating system to be loaded before they can function.
The contents of a Flash ROM may be logically partitioned into several functional divisions or regions. One such region is the firmware store which includes the loadable image of startup firmware and security firmware modules and must be protected from alteration by any entity except for entities that have been authorized to update the firmware store. A second region called the Authenticated Variable Region or Store holds Authenticated Variables defined in the UEFI specification and is used to hold UEFI-defined security information (the security database). In addition to the UEFI-defined information the Authenticated Variable Store can be used to store user-defined data related to the ultimate uses of the computer. Because it contains security data and potentially sensitive user data the UEFI specification provides that the Authenticated Variable Region/Store must be protected from alteration by any entity except those authorized by the presence of identifying key data within the security database. A third region, the UEFI variable store, contains lower security information which may be freely updated by user programs. On various platforms certain other regions exist each with unique update restrictions and the method describe herein can be extended to protect against unauthorized modification to these regions as well.
The computing device contains one or more elements known as Central Processing Units (CPU) which, when in operation, can read from and also perform input-output commands to erase and/or write the flash ROM. The CPU has a normal operating mode and a second operating mode called System Management Mode (SMM). When the CPU is in normal operating mode it can access all elements of the computer except certain memory regions exclusively dedicated to SMM. In contrast, when the CPU is operating in SMM it is able to access all elements of the computing device including the dedicated memory. An electrical signal is made available within the circuitry of the computing device which can indicate when the CPU is operating within SMM. The CPU device may be directed to transition from normal operating mode to SMM by a number of triggers called System Manage Interrupt (SMI) events including SMI events triggered by firmware. The exact triggers available differ somewhat from among system designs but the result when the platform appropriate trigger is used is always that execution in main memory is immediately suspended and execution begins at a specific location in SMM memory. Certain computing devices also contain a hardware circuit that can detect if the system is in SMM and is able to disable flash ROM erase and write operations when the system is not in SMM.
Unfortunately, there exists today a wide variety of software created by unauthorized third parties with the explicit intent to damage or subvert the proper operation of computing devices such as PCs. Given the names ‘computer virus’ or ‘malware’, these rogue software elements increasingly target the boot process as a way to get control of a computing device before preventive (e.g.: anti-virus) software has loaded. Exemplary forms of boot attacking software are known as root-kits or the ‘Trojan Boot Virus’.
There is a need to occasionally update the firmware and related data contained in the flash ROM (or other ROM) without compromising security of the computing device by allowing root kits or Trojan Boot viruses access to the firmware. While the Flash ROM may have intrinsic protection devices known as block write enables, these are not suitable for protection of a flash-resident data item that needs an update during system operation while restricting the ability to perform the update only to those originated by a trusted authority. The intrinsic flash ROM protection is generally composed of arrays of bits that when set prevent writes to a sub-region. This type of complete write prevention however does not allow selective updates performed by trusted authorities.